@cosmicdrift/kumiko-framework 0.384.0 → 0.386.0

package/dist/api/auth-routes-token-flows.d.ts

@@ -0,0 +1,4 @@
+import type { AuthRouteContext } from "./auth-routes-context.ts";
+export declare function registerPasswordResetRoutes(ctx: AuthRouteContext): void;
+export declare function registerEmailVerificationRoutes(ctx: AuthRouteContext): void;
+export declare function registerAccountUnlockRoutes(ctx: AuthRouteContext): void;

package/dist/api/auth-routes-token-flows.js

@@ -0,0 +1,91 @@
+import * as z from "zod";
+import { createAnonymousUser } from "../engine/system-user.js";
+import { SYSTEM_TENANT_ID } from "../engine/types/index.js";
+import { Routes } from "./api-constants.js";
+import { registerTokenRequestRoute } from "./auth-routes-shared.js";
+const ResetPasswordBody = z.object({
+    token: z.string().min(1),
+    newPassword: z.string().min(8).max(200),
+});
+const VerifyEmailBody = z.object({
+    token: z.string().min(1),
+});
+function registerTokenConfirmRoute(opts) {
+    opts.api.post(opts.path, async (c) => {
+        const raw = await c.req.json().catch(() => null);
+        const parsed = opts.schema.safeParse(raw);
+        if (!parsed.success) {
+            return c.json({ isSuccess: false, error: "invalid_body" }, 400);
+        }
+        const result = await opts.dispatcher.write(opts.confirmHandler, parsed.data, createAnonymousUser(SYSTEM_TENANT_ID));
+        if (!result.isSuccess) {
+            const status = result.error.httpStatus; // @cast-boundary engine-payload
+            return c.json({ isSuccess: false, error: result.error }, status);
+        }
+        return c.json({ isSuccess: true });
+    });
+}
+export function registerPasswordResetRoutes(ctx) {
+    const { api, dispatcher, config } = ctx;
+    // POST /auth/request-password-reset + /auth/reset-password — public.
+    // Silent-success on request (no enumeration), typed failure on confirm.
+    // Rate-limit covered via config.rateLimit.auth (Sprint G.5 L2, /auth/*).
+    if (config.passwordReset) {
+        const pr = config.passwordReset;
+        registerTokenRequestRoute({
+            api,
+            dispatcher,
+            path: Routes.authRequestPasswordReset,
+            requestHandler: pr.requestHandler,
+        });
+        registerTokenConfirmRoute({
+            api,
+            dispatcher,
+            path: Routes.authResetPassword,
+            confirmHandler: pr.confirmHandler,
+            schema: ResetPasswordBody,
+        });
+    }
+}
+export function registerEmailVerificationRoutes(ctx) {
+    const { api, dispatcher, config } = ctx;
+    // Email-verification mirrors password-reset.
+    if (config.emailVerification) {
+        const ev = config.emailVerification;
+        registerTokenRequestRoute({
+            api,
+            dispatcher,
+            path: Routes.authRequestEmailVerification,
+            requestHandler: ev.requestHandler,
+        });
+        registerTokenConfirmRoute({
+            api,
+            dispatcher,
+            path: Routes.authVerifyEmail,
+            confirmHandler: ev.confirmHandler,
+            schema: VerifyEmailBody,
+        });
+    }
+}
+export function registerAccountUnlockRoutes(ctx) {
+    const { api, dispatcher, config } = ctx;
+    // Account-unlock mirrors email-verification (token-only confirm body) —
+    // clears the Redis lockout state instead of an entity field, see
+    // confirm-account-unlock.write.ts.
+    if (config.accountUnlock) {
+        const au = config.accountUnlock;
+        registerTokenRequestRoute({
+            api,
+            dispatcher,
+            path: Routes.authRequestAccountUnlock,
+            requestHandler: au.requestHandler,
+        });
+        registerTokenConfirmRoute({
+            api,
+            dispatcher,
+            path: Routes.authConfirmAccountUnlock,
+            confirmHandler: au.confirmHandler,
+            schema: VerifyEmailBody,
+        });
+    }
+}

package/dist/api/auth-routes-types.d.ts

@@ -0,0 +1,76 @@
+import type { SessionUser } from "../engine/types/index.ts";
+import type { AuthSessionChecker, TokenVerifier } from "./auth-middleware.ts";
+import type { ClientIpResolver } from "./client-ip.ts";
+import type { PostAuthLandingResolver } from "./post-auth-landing.ts";
+export type LoginRateLimiter = {
+    check(key: string): Promise<boolean>;
+    reset(key: string): Promise<void>;
+};
+export type SessionMetadata = {
+    readonly ip: string;
+    readonly userAgent: string;
+};
+export type SessionCreator = (user: SessionUser, meta: SessionMetadata) => Promise<string>;
+export type SessionRevoker = (sid: string) => Promise<void>;
+export type SessionMassRevoker = (userId: string) => Promise<number>;
+export type SessionChecker = AuthSessionChecker;
+export type AuthRoutesConfig = {
+    membershipQuery: string;
+    userQuery?: string;
+    loginHandler?: string;
+    loginErrorStatusMap?: Readonly<Record<string, number>>;
+    loginRateLimit?: LoginRateLimiter | null;
+    mfaVerifyHandler?: string;
+    switchTenantMfaGateHandler?: string;
+    mfaVerifyErrorStatusMap?: Readonly<Record<string, number>>;
+    mfaVerifyRateLimit?: LoginRateLimiter | null;
+    mfaPreauthEnableStartHandler?: string;
+    mfaPreauthEnableStartErrorStatusMap?: Readonly<Record<string, number>>;
+    mfaPreauthEnableStartRateLimit?: LoginRateLimiter | null;
+    mfaPreauthConfirmHandler?: string;
+    mfaPreauthConfirmErrorStatusMap?: Readonly<Record<string, number>>;
+    mfaPreauthConfirmRateLimit?: LoginRateLimiter | null;
+    sessionCreator?: SessionCreator;
+    sessionRevoker?: SessionRevoker;
+    sessionChecker?: SessionChecker;
+    tokenVerifier?: TokenVerifier;
+    patRateLimiter?: LoginRateLimiter;
+    resolveTenantLifecycleStatus?: import("./auth-middleware.ts").TenantLifecycleStatusResolver;
+    passwordReset?: PasswordResetConfig;
+    emailVerification?: EmailVerificationConfig;
+    accountUnlock?: AccountUnlockConfig;
+    signup?: SignupConfig;
+    invite?: InviteConfig;
+    cookieSameSite?: "lax" | "strict";
+    cookieDomain?: string;
+    secureCookies?: boolean;
+    retiredCookieDomains?: readonly string[];
+    allowedOrigins?: readonly string[];
+    publicOrigin?: string;
+    unsafeSkipOriginCheck?: boolean;
+    trustedProxyHops?: number;
+    postAuthLanding?: PostAuthLandingResolver;
+    resolver?: ClientIpResolver;
+};
+export type PasswordResetConfig = {
+    requestHandler: string;
+    confirmHandler: string;
+};
+export type EmailVerificationConfig = {
+    requestHandler: string;
+    confirmHandler: string;
+};
+export type AccountUnlockConfig = {
+    requestHandler: string;
+    confirmHandler: string;
+};
+export type InviteConfig = {
+    readonly acceptHandler: string;
+    readonly acceptWithLoginHandler: string;
+    readonly signupCompleteHandler: string;
+    readonly infoHandler?: string;
+};
+export type SignupConfig = {
+    requestHandler: string;
+    confirmHandler: string;
+};

package/dist/api/auth-routes-types.js

@@ -0,0 +1 @@
+export {};

package/dist/api/auth-routes.d.ts

@@ -1,89 +1,9 @@
-import { Hono } from "hono";
-import type { Redis } from "ioredis";
-import { type SessionUser } from "../engine/types/index.ts";
+import type { Hono } from "hono";
 import type { Dispatcher } from "../pipeline/dispatcher.ts";
-import { type AuthSessionChecker, type AuthSessionStatus, type TokenVerifier } from "./auth-middleware.ts";
-import { type ClientIpResolver } from "./client-ip.ts";
+import type { AuthRoutesConfig } from "./auth-routes-types.ts";
 import type { JwtHelper } from "./jwt.ts";
-import type { PostAuthLandingResolver } from "./post-auth-landing.ts";
-export type LoginRateLimiter = {
-    check(key: string): Promise<boolean>;
-    reset(key: string): Promise<void>;
-};
-export type SessionMetadata = {
-    readonly ip: string;
-    readonly userAgent: string;
-};
-export type SessionCreator = (user: SessionUser, meta: SessionMetadata) => Promise<string>;
-export type SessionRevoker = (sid: string) => Promise<void>;
-export type SessionMassRevoker = (userId: string) => Promise<number>;
-export type SessionChecker = AuthSessionChecker;
-export type { AuthSessionStatus };
+export type { AuthSessionStatus } from "./auth-middleware.ts";
+export { createInMemoryLoginRateLimiter, createRedisLoginRateLimiter, inMemoryLoginRateLimiterFallback, } from "./auth-rate-limiters.ts";
+export type { AccountUnlockConfig, AuthRoutesConfig, EmailVerificationConfig, InviteConfig, LoginRateLimiter, PasswordResetConfig, SessionChecker, SessionCreator, SessionMassRevoker, SessionMetadata, SessionRevoker, SignupConfig, } from "./auth-routes-types.ts";
 export declare function assertSessionCallbacksPaired(auth: Pick<AuthRoutesConfig, "sessionCreator" | "sessionRevoker" | "sessionChecker"> | undefined): void;
-export type AuthRoutesConfig = {
-    membershipQuery: string;
-    userQuery?: string;
-    loginHandler?: string;
-    loginErrorStatusMap?: Readonly<Record<string, number>>;
-    loginRateLimit?: LoginRateLimiter | null;
-    mfaVerifyHandler?: string;
-    switchTenantMfaGateHandler?: string;
-    mfaVerifyErrorStatusMap?: Readonly<Record<string, number>>;
-    mfaVerifyRateLimit?: LoginRateLimiter | null;
-    mfaPreauthEnableStartHandler?: string;
-    mfaPreauthEnableStartErrorStatusMap?: Readonly<Record<string, number>>;
-    mfaPreauthEnableStartRateLimit?: LoginRateLimiter | null;
-    mfaPreauthConfirmHandler?: string;
-    mfaPreauthConfirmErrorStatusMap?: Readonly<Record<string, number>>;
-    mfaPreauthConfirmRateLimit?: LoginRateLimiter | null;
-    sessionCreator?: SessionCreator;
-    sessionRevoker?: SessionRevoker;
-    sessionChecker?: SessionChecker;
-    tokenVerifier?: TokenVerifier;
-    patRateLimiter?: LoginRateLimiter;
-    resolveTenantLifecycleStatus?: import("./auth-middleware.ts").TenantLifecycleStatusResolver;
-    passwordReset?: PasswordResetConfig;
-    emailVerification?: EmailVerificationConfig;
-    accountUnlock?: AccountUnlockConfig;
-    signup?: SignupConfig;
-    invite?: InviteConfig;
-    cookieSameSite?: "lax" | "strict";
-    cookieDomain?: string;
-    secureCookies?: boolean;
-    retiredCookieDomains?: readonly string[];
-    allowedOrigins?: readonly string[];
-    publicOrigin?: string;
-    unsafeSkipOriginCheck?: boolean;
-    trustedProxyHops?: number;
-    postAuthLanding?: PostAuthLandingResolver;
-    resolver?: ClientIpResolver;
-};
-export type PasswordResetConfig = {
-    requestHandler: string;
-    confirmHandler: string;
-};
-export type EmailVerificationConfig = {
-    requestHandler: string;
-    confirmHandler: string;
-};
-export type AccountUnlockConfig = {
-    requestHandler: string;
-    confirmHandler: string;
-};
-export type InviteConfig = {
-    readonly acceptHandler: string;
-    readonly acceptWithLoginHandler: string;
-    readonly signupCompleteHandler: string;
-    readonly infoHandler?: string;
-};
-export type SignupConfig = {
-    requestHandler: string;
-    confirmHandler: string;
-};
-export declare function inMemoryLoginRateLimiterFallback(): LoginRateLimiter;
-export declare function createInMemoryLoginRateLimiter(maxAttempts?: number, windowMs?: number, { maxEntries, sweepThreshold, }?: {
-    maxEntries?: number;
-    sweepThreshold?: number;
-}): LoginRateLimiter;
-export declare function createRedisLoginRateLimiter(redis: Redis, maxAttempts?: number, windowMs?: number, namespace?: string): LoginRateLimiter;
 export declare function createAuthRoutes(dispatcher: Dispatcher, jwt: JwtHelper, config: AuthRoutesConfig): Hono;